Vulnerability Details : CVE-2007-2446

Public exploit exists!
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
Published 2007-05-14 21:19:00
Updated 2018-10-16 16:43:42
Source Red Hat, Inc.
View at NVD,   CVE.org
Vulnerability category: OverflowExecute code

Exploit prediction scoring system (EPSS) score for CVE-2007-2446

Probability of exploitation activity in the next 30 days: 96.49%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2007-2446

  • Samba lsa_io_trans_names Heap Overflow
    Disclosure Date: 2007-05-14
    First seen: 2020-04-26
    exploit/solaris/samba/lsa_transnames_heap
    This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the TALLOC chunk overwrite method (credit Ramon and Adriano), which only works with Samba versions 3.0.21-3.0.24. Additionally, this module will not work when the Samba
  • Samba lsa_io_trans_names Heap Overflow
    First seen: 2020-04-26
    auxiliary/dos/samba/lsa_transnames_heap
    This module triggers a heap overflow in the LSA RPC service of the Samba daemon. Authors: - hdm <x@hdm.io>
  • Samba lsa_io_privilege_set Heap Overflow
    First seen: 2020-04-26
    auxiliary/dos/samba/lsa_addprivs_heap
    This module triggers a heap overflow in the LSA RPC service of the Samba daemon. Authors: - hdm <x@hdm.io>
  • Samba lsa_io_trans_names Heap Overflow
    Disclosure Date: 2007-05-14
    First seen: 2020-04-26
    exploit/osx/samba/lsa_transnames_heap
    This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the szone_free() to overwrite the size() or free() pointer in initial_malloc_zones structure. Authors: - Ramon de C Valle <rcvalle@metasploit.com> - Adriano Lima <adriano
  • Samba lsa_io_trans_names Heap Overflow
    Disclosure Date: 2007-05-14
    First seen: 2020-04-26
    exploit/linux/samba/lsa_transnames_heap
    This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the TALLOC chunk overwrite method (credit Ramon and Adriano), which only works with Samba versions 3.0.21-3.0.24. Additionally, this module will not work when the Samba

CVSS scores for CVE-2007-2446

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
10.0
 HIGH AV:N/AC:L/Au:N/C:C/I:C/A:C
10.0
10.0
 NIST

CWE ids for CVE-2007-2446

References for CVE-2007-2446

Products affected by CVE-2007-2446

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close